3 ms·
>Any time GnuPG has to deal with such a spammed certificate, GnuPG grinds to a halt. So the SKS software is only a part of the problem. Another part is GnuPG,
by ComodoHacker 7y ago
>Any time GnuPG has to deal with such a spammed certificate, GnuPG grinds to a halt.
So the SKS software is only a part of the problem. Another part is GnuPG, which is unable to deal with a public key with many signatures attached.
GnuPG is written in C (not OCaml) and seems to be well maintained. Looks like fixing it can be an effective mitigation against this attack. Or do I miss something?
- CameronNemo 7y agoNot sure how you could fix an OpenPGP client for this case without changing how the keyservers function.
- viraptor 7y ago"You're trying to pull more than reasonably supported 1k signatures. Do you want to skip this step?"
- maddyboo 7y agoThis will protect your machine from being DoS’d, but what if your key is poisoned? Nobody will be able to use it.
- ComodoHacker 7y agoOptimize to handle 150K signatures in reasonable time.